Hidden paths and access policies

A PathGuard service is invisible because nobody can build a path to it without permission. This page explains what makes a path hidden, and how the enterprise decides who gets the path.

Public and hidden path segments

In the SCION Internet, a sender builds the path to a destination from path segments. Each AS publishes the segments that lead to it. A sender combines segments into a complete path, for example a segment from its own AS to the core of the network and a segment from the core to the destination AS. Paths and policies in the SCION SDK documentation explains paths in detail.

A hidden AS does not publish its segments in the public path servers. It registers them only with the Hidden Segment Directory (HSD). The HSD gives these hidden segments only to clients that the access policy of the hidden AS allows.

The public path servers give the public segments to everyone. Only the HSD has the hidden segment to the hidden AS. An authorized client gets it and combines both into one path.

Access policies

The enterprise sets an access policy for its hidden AS. The access policy names the clients that can get the hidden segments. A policy can allow clients in two ways:

• Client credentials: For applications and devices, for example a field device, a server, or a managed laptop. The enterprise gives a credential to each device, for example an API key or a client certificate. The policy names the devices or the organization that can get the segments.
• OIDC claims: For users of an identity provider, for example the identity provider of the enterprise. The policy names the claims that a user must have, for example the membership in the group "remote-access".

The policy can name the users, the organizations, or the devices that get the hidden segments. To remove the access of a user, the enterprise changes the policy or disables the user in the identity provider.

What an unauthorized client gets

An unauthorized client gets an empty answer from the HSD. The answer is the same as for an AS that has no hidden segments, so it does not tell the client that the hidden AS exists. Without the hidden segments, the client cannot build a path to the hidden AS. Packets on a guessed path do not have valid hop fields, so the SCION routers drop them.

The hidden AS is not only protected against the public Internet. Other SCION users without authorization cannot reach it either.

Availability of the HSD

Every authorized client needs the HSD to get the hidden segments. An attack on the HSD could thus keep authorized users away from the service. To prevent this, more than one HSD can hold the hidden segments of an AS, and independent operators in different regions can run them. A client can then ask any HSD that has the segments.